Forensic Field Research Articles

Forensic analysis of planned and unplanned complex suicides: a case series

ABSTRACT Research on suicide has always been an area of particular interest in the forensic field. Over time, classifications have been proposed to define different types of suicide. A category is represented by complex suicides (CS) defined using two or more suicide methods simultaneously or consecutively. Considering the victim’s intentions, CS can be distinguished into planned, in which the victim plans the methods to ensure the fatal outcome, and unplanned, in which the methods are implemented in the mid-course because the first proves too painful or prolonged. The sometimes-varied dynamics with which such suicides are carried out can pose a diagnostic challenge for forensic pathologists and investigators. This paper aims to report the case history of complex suicides analysed during a year at the University of Rome ‘Tor Vergata’. For each case, the data from the on-site investigation (presence of suicide note and anamnestic information from the medical records of the deceased or family members’ reports) and autopsy investigations were analysed and discussed, with particular reference to the suicide methods used. For each case, a classification into planned and unplanned was proposed based on an integrated analytical approach.

A Detection and Investigation Model for the Capture and Analysis of Network Crimes

Investigation in the field of network forensics involves examining network traffic to identify, capture, preserve, reconstruct, analyze, and document network crimes. Although there are different perspectives on the practical and technical aspects of network forensics, there is still a lack of fundamental guidelines. This paper proposes a new detection and investigation model for capturing and analyzing network crimes, using design science research. The proposed model involves six processes: identification, verification, gathering, preservation, examination, analysis, and documentation. Each process is associated with several activities that provide the investigation team with a clear picture of exactly what needs to be performed. In addition, the proposed model has a unique activity, namely reporting. As a result, this model represents a comprehensive approach to network forensics investigations. It is designed to work in conjunction with established forensic techniques to ensure that forensic evidence from the network is collected and analyzed efficiently and effectively following accepted forensic procedures. The proposed model was compared with existing models in terms of completeness, showing that it is complete and can be adapted to any type of network and legal framework.

A Conceptual Digital Forensic Investigation Model Applicable to the Drone Forensics Field

Although there is a considerable amount of studies in drone forensics that describe numerous practical and technical perspectives, there is a lack of a comprehensive investigation framework. This study used design science research methodology to design a conceptual model for the comprehensive investigation of Unmanned Aerial Vehicles (UAVs) under forensic conditions. This model can identify, capture, preserve, analyze, and document UAV incidents. The proposed model consists of four stages: preparation, data collection, analysis, and documentation. In the preparation stage, data are collected and analyzed about UAV-related resources, including the origin and model of the aircraft, any software or hardware installed onboard, and the legal framework and regulations in place. The data collection stage involves the completion of the collection process, where participants gather parts of the UAV and the data needed, such as the flight controller, flight log, and memory cards. The analysis stage involves analyzing the collected evidence. Lastly, the documentation stage involves documenting relevant evidence, analysis results, and any conclusions derived. This model provides a comprehensive process to forensically investigate UAV incidents and provides an efficient and effective approach to the analysis of UAV evidence, ensuring that evidence was collected and analyzed according to accepted forensic techniques. The proposed model can be applied to any UAV type and legal framework.

Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems

With the continuously increasing number of security incidents targeting sensors, embedded devices, and other electronics appliances and systems that comprise the so-called Internet of things (IoT), the field of IoT forensics emerged as a branch of digital forensics focusing on the investigation of attacks in the IoT ecosystem. Digital evidence authenticity, integrity, confidentiality, and privacy are among the factors affecting the investigation process in IoT forensics, which can be addressed by employing the blockchain as the means not only for the preservation of digital evidence, but also for other steps of a digital forensics investigation process. The high-level goal of the paper is three-fold: to establish a holistic IoT forensics process as a reference point against which blockchain integration patterns and best practices will be identified in order to yield a robust, widely accepted and scalable architecture of the blockchain-enabled solution; to integrate the blockchain with the proposed IoT forensics process for addressing the above challenges; and to evaluate the overall solution highlighting improvements and potential performance bottlenecks. The proposed blockchain-enabled platform leverages multi-access edge computing and has been implemented with Hyperledger Fabric on an extensive virtualized testbed providing a realistic smart home environment. A thorough evaluation was conducted with real cyber-attacks generating digital evidence at high rates for testing the platform’s behavior at high load. The experimental results showed that the proposed platform achieved high throughput, excessively low latency, and zero error rate in the operation of the blockchain network.

Improving Estimation of Layer Thickness and Identification of Slicer for 3D Printing Forensics.

This study emphasizes the significance of estimating the layer thickness and identifying slicer programs in the realm of 3D printing forensics. With the progress in 3D printing technology, precise estimation of the layer thickness has become crucial. However, previous research on layer thickness estimation has mainly treated the problem as a classification task, which is inadequate for continuous layer thickness parameters. Furthermore, previous studies have concentrated on hardware-based printer identification, but the identification of slicer programs through 3D objects is a vital aspect of the software domain and can provide valuable clues for 3D printing forensics. In this study, a regression-based approach utilizing a vision transformer model was proposed. Experiments conducted on the SI3DP++ dataset demonstrated that the proposed model could handle a broad range of data and outperform the current classification models. Additionally, this study proposed a new research direction by introducing slicer program identification, which significantly contributes to the field of 3D printing forensics.

Forensic analysis of SQL server transaction log in unallocated area of file system

The importance of database forensics is increasing day by day as the use of databases to store sensitive corporate and personal data increases. Database forensics is a field of digital forensics that deals with database-related incidents such as data corruption, breaches, and leaks. One of the key functions of database forensics is information reconstruction, which is the tracing of actions from the time of an event to the present based on various information stored in the database. This feature allows investigators to identify unauthorized user actions and data deletion or manipulation when an incident occurs. Database log data is primarily used to reconstruct information. Database logs include transaction logs, error logs, event logs, and trace logs. Among them, we focus on the transaction log of Microsoft SQL Server (MSSQL), one of the most popular database management systems in the world. Raw-level studies have been conducted on the transaction logs of Oracle and MySQL, other databases used at the enterprise level. However, there is very little research on MSSQL transaction logs. For this reason, we analyze the internal structure of the MSSQL transaction log. Based on these finding, we present an empirical method to identify and extract transaction log records in unallocated area.

ChatGPT for digital forensic investigation: The good, the bad, and the unknown

The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.

Bike computer forensics: An efficient and robust method for FIT file recovery

The popularity of bike computer devices has grown in recent years. These devices generate a wealth of data in the form of Flexible and Interoperable Data Transfer (FIT) files, which can be used to store fitness related data efficiently. However, the recovery of corrupted FIT files remains a significant challenge due to their inherent structure. The format relies on a chain of messages stored sequentially, with each message referencing previous data to parse the subsequent record. As a result, the recovery of data situated between corrupted portions becomes notably challenging. This study introduces an efficient, and robust method for dense recovery of corrupted files. Our approach combines multiple phases of data carving techniques to maximize data recovery. By employing this method, investigators can effectively access crucial information including accident reconstruction, and criminal activities. The proposed methods demonstrate higher recovery rate through the proof-of-concept and real-world experiments, proving its utility and reliability in the field of digital forensics.

Advanced file carving: ontology, models and methods

File carving techniques are important in the field of digital forensics. At the same time, the rapid growth in the amount and types of data requires the development of file carving methods in terms of capabilities, accuracy, and computational efficiency. However, most of the methods are developed to solve specific tasks and are based on a certain set of assumptions and a priori knowledge about the files to be recovered. There is a lack of research that systematizes methods and structures approaches to identify gaps and determine perspective directions for development, considering the latest advances in information technology and artificial intelligence. The subject matter of this article is the structure, factors, efficiency criteria, methods, and tools of file carving, as well as the current state and tendencies of development of file carving methods. The goal of this study is to systematize knowledge about advanced file carving methods and identify perspective directions for their development. The tasks to be solved are as follows: to identify the main stages of file carving and analyze approaches to their implementation; to build an ontological scheme of file carving; and to identify perspective directions for the development of carving methods. The methods used were literature review, systematization, and summarization. The obtained results are as follows. An ontological scheme for the file carving concept is constructed. The scheme includes the principles, properties, phases, techniques, evaluation criteria, tools used, and factors influencing file carving. The features, limitations, and fields of application of the data recovery methods are provided. It was established that the most widespread approach to file reconstruction is still a manually detailed analysis of the internal structure of files and/or their contents, identifying specific patterns that allow reassembling the sequence of data fragments in the correct order. However, most of the methods do not provide one hundred percent guaranteed results. This article analyzes the current state and prospects of using artificial intelligence methods in the field of digital forensics, particularly for identifying data blocks, clustering, and reconstructing files, as well as restoring the contents of media files with damaged or lost headers. The necessity of having priori information about the file structure or content for successfully carving fragmented data is determined. Conclusions. The scientific novelty of the obtained results is as follows: for the first time, advanced file carving methods are systematized and analyzed by directions of development and the perspectives of using artificial intelligence for identifying data blocks, clustering, and file content restoration; for the first time, an ontological scheme of file carving is constructed, which can be used as a roadmap for developing new advanced systems in the digital forensics field.

Multi-omics integration strategy in the post-mortem interval of forensic science

Estimates of post-mortem interval (PMI), which often serve as pivotal evidence in forensic contexts, are fundamentally based on assessments of variability among diverse molecular markers (including proteins and metabolites), their correlations, and their temporal changes in post-mortem organisms. Nevertheless, the present approach to estimating the PMI is not comprehensive and exhibits poor performance. We developed an innovative approach that integrates multi-omics and artificial intelligence, using multimolecular, multimarker, and multidimensional information to accurately describe the intricate biological processes that occur after death, ultimately enabling inference of the PMI. Called the multi-omics stacking model (MOSM), it combines metabolomics, protein microarray electrophoresis, and fourier transform-infrared spectroscopy data. It shows improved prediction accuracy of the PMI, which is urgently needed in the forensic field. It achieved an accuracy of 0.93, generalized area under the receiver operating characteristic curve of 0.98, and minimum mean absolute error of 0.07. The MOSM integration framework not only considers multiple markers but also incorporates machine-learning models with distinct algorithmic principles. The diversity of biological mechanisms and algorithmic models further ensures the generalizability and robustness of PMI estimation.

A genome-wide association scan reveals novel loci for facial traits of Koreans

DNA-based prediction of externally visible characteristics (EVC) with SNPs is one of the research areas of interest in the forensic field. Based on a previous study performing GWAS on facial traits in a Korean population, herein, we present results stemming from GWA analysis with KoreanChip and novel genetic loci satisfying genome-wide significant level. We discovered a total of 20 signals and 12 loci were found to have novel associations with facial traits, including six loci located in intergenic regions and six loci located at UBE2O, HECTD2, CCDC108, TPK1, FCN2, and FRMPD1. Additionally, we performed a polygenic score analysis for 33 distance-related traits in facial phenotyping and determined genetic relationships between facial traits and SNPs using the GCTA program. The results of the current study offer an understanding of how facial morphology is influenced by complex genetic structures and provide insights into forensic investigation and population genetics.

Hierarchical deep learning approach using fusion layer for Source Camera Model Identification based on video taken by smartphone

Over the last decade, videos uploaded and shared through web-based multimedia platforms and mobile applications have proliferated worldwide. This is because cloud-based applications such as iCloud, YouTube, Facebook, Twitter, and WhatsApp offer affordable and secure environments for video storage and sharing. However, new challenges have emerged alarming forensic analysts and investigators since videos can be used to commit heinous crimes such as blackmail, fraud, and forgery. Source Camera Identification (SCI) has become of paramount importance in the field of image and video forensics. Camera model identification can also help identify the perpetrators or narrow down the search and can be used to enhance SCI systems. In this context, existing approaches such as the Photo Response Non-Uniformity (PRNU) based methods and machine learning techniques such as the support vector machine (SVM) and deep learning models are commonly used solutions. This work exploits these two categories of methods by exploring a hierarchical deep learning model for camera model identification based on smartphone videos. The PRNU features are extracted by CNN-based structures during the training process. Proposed six-stream networks are leveraged to extract both low-level and high-level features through the network. A fusion layer is created based on joint sparse representation using forward and backward functions defined for fusing the proposed six streams. The proposed approach has been implemented and evaluated through intensive experiments, and results showed successful camera model identification with a performance at the frame level reaching an average accuracy of 69.9% for the Daxing dataset and 81.6% for the QUFVD dataset.

Oxygen Isotope Alterations during the Reduction of U3O8 to UO2 for Nuclear Forensics Applications.

The fabrication of UO2 from U3O8 is an essential reaction in the nuclear fuel cycle. The oxygen isotope fractionation associated with this reaction has significant implications in the general field of nuclear forensics. Hence, the oxygen isotope fractionation during the reduction of U3O8 to UO2 was determined in the temperature range of 500-700 °C and for a duration of 2 to 6 h under a high-purity H2 atmosphere. Three U3O8 samples, possessing a different oxygen isotopic composition, were used to investigate key parameters involved with the fractionation during the reduction process. All UO2 products did not maintain the original isotope composition of the starting U3O8 under all conditions. The results show that the system UO2-H2O attains isotope equilibrium at 600 °C, provided the reduction process lasts at least 4 h or more. At 600 °C, UO2 was isotopically depleted by 2.89 ± 0.82‰ compared to the U3O8 from which it was produced. We find that the H2O formed during the reduction plays a major role in determining the final δ18O of UO2 prepared from U3O8. The isotope equilibrium of the system UO2-H2O at 600 °C was calculated, indicating that δ18O of the H2O was enriched by about 11‰ relative to the UO2 due to the uranium mass effect. These findings could potentially have important implications for nuclear forensics, as they provide a new method for determining the history of UO2 samples and tracing back their production process.

Introduction to Digital Forensics

Abstract: Crimes committed using computers are increasing rapidly, posing a challenge to law enforcement. Investigations including cybercrime, terrorism, and civil litigation all make use of digital forensics today. Because of the ever-increasing sophistication of modern technology, forensic investigations of this sort can quickly become difficult and time-consuming. In order to successfully retrieve meaningful digital evidence during such investigations, however, a standard framework for digital forensic professionals to follow must be developed. All appropriate steps that a digital forensic investigation would take should be highlighted by the framework and methodology used to conduct digital forensics. This study provides a system for conducting digital forensic investigations with an emphasis on the forensic aspects of those probes, the tools and procedures employed by examiners, and the significance of hashing in preventing the manipulation of evidence. Digital forensics, as a whole, is still a field that is widely growing along with the continually advancing world of technology. This form of forensics is one that is also growing in importance and necessity due to crimes stemming from digital devices becoming increasingly popular as well. These steady numbers are what have and will continue to drive the field of digital forensics into meeting its full potential on a consistent basis, in both a preventative and recovering manner. However, in order to recognize this potential, it is important to first understand what digital forensics really entails

Study of Root Transparency in Different Postmortem Intervals Using Scanning Electron Microscopy.

In the fields of forensics, the identification of human remains is a recurrent problem. The estimated age at death is one of the copious criteria to be evaluated. In adult teeth, the height of the root dentin transparency is used to estimate age. However, in archaeological material, this phenomenon appears inconstant. The aim of this work was to observe the structural modifications of the sclerotic dentin in the teeth for different postmortem intervals. The study included two parts (retrospective and prospective study) with 21 human monoradicular teeth, from bodies donated to medical science with postmortem intervals (PMIs) of 0, 1, 2 and 5 years and archeological excavation. After inclusion based on resin, section and polishing, the samples were analyzed with a scanning electron microscope (SEM) JSM-7800F®, and the procedure was completed via a semiquantitative analysis of calcium and phosphorus using EDX microanalysis. The analysis showed the existence of tubular and chemical modifications of sclerotic dentin at different PMIs. Our SEM study allowed us to observe a difference in tubule aspects linked to an increased PMI: the loss of peritubular collar and the lumen obstruction of tubules with a hyperdense material. Microanalysis highlighted variations in phosphocalcic ratios among the different groups, especially in the pulp area and the canine. Our hypotheses that explain these differences are based on the postmortem modifications of the crystals of the mineral phase of sclerotic dentin under the influence of chemical and/or bacterial action.

Source Camera Identification with a Robust Device Fingerprint: Evolution from Image-Based to Video-Based Approaches.

With the increasing prevalence of digital multimedia content, the need for reliable and accurate source camera identification has become crucial in applications such as digital forensics. While effective techniques exist for identifying the source camera of images, video-based source identification presents unique challenges due to disruptive effects introduced during video processing, such as compression artifacts and pixel misalignment caused by techniques like video coding and stabilization. These effects render existing approaches, which rely on high-frequency camera fingerprints like Photo Response Non-Uniformity (PRNU), inadequate for video-based identification. To address this challenge, we propose a novel approach that builds upon the image-based source identification technique. Leveraging a global stochastic fingerprint residing in the low- and mid-frequency bands, we exploit its resilience to disruptive effects in the high-frequency bands, envisioning its potential for video-based source identification. Through comprehensive evaluation on recent smartphones dataset, we establish new benchmarks for source camera model and individual device identification, surpassing state-of-the-art techniques. While conventional image-based methods struggle in video contexts, our approach unifies image and video source identification through a single framework powered by the novel non-PRNU device-specific fingerprint. This contribution expands the existing body of knowledge in the field of multimedia forensics.

Multi-attention-based approach for deepfake face and expression swap detection and localization

Advancements in facial manipulation technology have resulted in highly realistic and indistinguishable face and expression swap videos. However, this has also raised concerns regarding the security risks associated with deepfakes. In the field of multimedia forensics, the detection and precise localization of image forgery has become essential tasks. Current deepfake detectors perform well with high-quality faces within specific datasets, but often struggle to maintain their performance when evaluated across different datasets. To this end, we propose an attention-based multi-task approach to improve feature maps for classification and localization tasks. The encoder and the attention-based decoder of our network generate localized maps that highlight regions with information about the type of manipulation. These localized features are shared with the classification network, improving its performance. Instead of using encoded spatial features, attention-based localized features from the decoder’s first layer are combined with frequency domain features to create a discriminative representation for deepfake detection. Through extensive experiments on face and expression swap datasets, we demonstrate that our method achieves competitive performance in comparison to state-of-the-art deepfake detection approaches in both in-dataset and cross-dataset scenarios. Code is available at https://github.com/saimawaseem/Multi-Attention-Based-Approach-for-Deepfake-Face-and-Expression-Swap-Detection-and-Localization.

Detection and confirmation of fentanyls in high clay-content soil by electron ionization gas chromatography-mass spectrometry.

Detection of illicit drugs in the environment, particularly in soils, often suggests the present or past location of a clandestine production center for these substances. Thus, development of efficient methods for the analysis and detection of these chemicals is of paramount importance in the field of chemical forensics. In this work, a method involving the extraction and retrospective confirmation of fentanyl, acetylfentanyl, thiofentanyl, and acetylthiofentanyl using trichloroethoxycarbonylation chemistry in a high clay-content soil is presented. The soil was spiked separately with each fentanyl at two concentrations (1 and 10 μg/g) and their extraction accomplished using ethyl acetate and aqueous NH4 OH (pH ~ 11.4) with extraction recoveries ranging from ~56% to 82% for the high-concentration (10 μg/g) samples while ranging from ~68% to 83% for the low-concentration (1 μg/g) samples. After their extraction, residues containing each fentanyl were reacted with 2,2,2-trichloroethoxycarbonyl chloride (Troc-Cl) to generate two unique and predictable products from each opioid that can be used to retrospectively confirm their presence and identity using EI-GC-MS. The method's limit of detection (MDL/LOD) for Troc-norfentanyl and Troc-noracetylfentanyl were estimated to be 29.4 and 31.8 ng/mL in the organic extracts. In addition, the method's limit of quantitation for Troc-norfentanyl and Troc-noracetylfentanyl were determined to be 88.2 and 95.5 ng/mL, respectively. Collectively, the results presented herein strengthen the use of chloroformate chemistry as an additional chemical tool to confirm the presence of these highly toxic and lethal substances in the environment.

Review of Image Forensic Techniques Based on Deep Learning

Digital images have become an important carrier for people to access information in the information age. However, with the development of this technology, digital images have become vulnerable to illegal access and tampering, to the extent that they pose a serious threat to personal privacy, social order, and national security. Therefore, image forensic techniques have become an important research topic in the field of multimedia information security. In recent years, deep learning technology has been widely applied in the field of image forensics and the performance achieved has significantly exceeded the conventional forensic algorithms. This survey compares the state-of-the-art image forensic techniques based on deep learning in recent years. The image forensic techniques are divided into passive and active forensics. In passive forensics, forgery detection techniques are reviewed, and the basic framework, evaluation metrics, and commonly used datasets for forgery detection are presented. The performance, advantages, and disadvantages of existing methods are also compared and analyzed according to the different types of detection. In active forensics, robust image watermarking techniques are overviewed, and the evaluation metrics and basic framework of robust watermarking techniques are presented. The technical characteristics and performance of existing methods are analyzed based on the different types of attacks on images. Finally, future research directions and conclusions are presented to provide useful suggestions for people in image forensics and related research fields.

Study of fingerprint patterns in relation to gender and blood groups

Dermatoglyphics (fingerprint/dactylography) is derived from the Greek word “Derma=Skin, Glyph=Carve.” Dermatoglyphics is defined as the scientific study of naturally occurring epidermal ridges and their configuration on the digits, palms and soles apart from flexion crease and secondary folds. The objective of the study was to determine correlation if any exits between the fingerprint pattern and blood group and gender. The general study design selected for this article was cross-sectional study. Here, the primary outcome variable is to determine correlation (if any) between the fingerprint pattern and blood group and gender. A total of 271 students volunteered for the study. Loops were found to the most prevalent type of fingerprint in all blood groups. Blood groups and primary fingerprint patterns were found to be associated with the association being statistically significant. The correlation between the said entities would enable better authentication and prediction of identity of a person and thereby has the potential for great application in the field of forensics.